diff options
author | Barton E. Schaefer <schaefer@zsh.org> | 2015-02-14 10:43:10 -0800 |
---|---|---|
committer | Barton E. Schaefer <schaefer@zsh.org> | 2015-02-14 10:43:10 -0800 |
commit | 2c13d9fb0da0ec513e577c2589ec545df665326e (patch) | |
tree | 85dddadf947f3da1255245925644675aa44efb0f /Src/lex.c | |
parent | dd988542f466fd87e7353a9cd89d4b1d7b6f075d (diff) | |
download | zsh-2c13d9fb0da0ec513e577c2589ec545df665326e.tar.gz zsh-2c13d9fb0da0ec513e577c2589ec545df665326e.tar.xz zsh-2c13d9fb0da0ec513e577c2589ec545df665326e.zip |
34543: Prevent crash on garbage bytes inside $(...)
Garbage input (nul bytes, etc.) can cause the $(...) parser to become confused during look-ahead and attempt to back up the input too far. This commit catches the error but does not fix the underlying cause.
Diffstat (limited to 'Src/lex.c')
-rw-r--r-- | Src/lex.c | 6 |
1 files changed, 4 insertions, 2 deletions
diff --git a/Src/lex.c b/Src/lex.c index 433c27fbb..91628d4c2 100644 --- a/Src/lex.c +++ b/Src/lex.c @@ -503,13 +503,15 @@ cmd_or_math(int cs_type) /* else unsuccessful: unget the whole thing */ hungetc(c); lexstop = 0; - while (lexbuf.len > oldlen) { + while (lexbuf.len > oldlen && !errflag) { lexbuf.len--; hungetc(itok(*--lexbuf.ptr) ? ztokens[*lexbuf.ptr - Pound] : *lexbuf.ptr); } + if (errflag) + return 2; hungetc('('); - return 0; + return errflag ? 2 : 0; } |